Tcl Source Code

Check-in [4865e19aac]
Login

Many hyperlinks are disabled.
Use anonymous login to enable hyperlinks.

Overview
Comment:[Bug 3598580]: Tcl_ListObjReplace may release deleted elements too early
Downloads: Tarball | ZIP archive | SQL archive
Timelines: family | ancestors | descendants | both | trunk
Files: files | file ages | folders
SHA1: 4865e19aacde9d2fb77491228d687364a51c94e4
User & Date: jan.nijtmans 2012-12-27 15:04:11
Context
2012-12-29
09:23
restore refcounts as they were before the Tcl_ListObjReplace call, in the error situation. In Tcl9,... check-in: f83c3f4bad user: jan.nijtmans tags: trunk
2012-12-27
15:05
merge trunk check-in: 721001a95f user: jan.nijtmans tags: novem
15:04
[Bug 3598580]: Tcl_ListObjReplace may release deleted elements too early check-in: 4865e19aac user: jan.nijtmans tags: trunk
14:57
[Bug 3598580]: Tcl_ListObjReplace may release deleted elements too early check-in: 6d560f6812 user: jan.nijtmans tags: core-8-5-branch
2012-12-26
09:59
eliminate dependancy of compat/*.h on tcl.h check-in: 1a74bb2740 user: jan.nijtmans tags: trunk
Changes
Hide Diffs Unified Diffs Ignore Whitespace Patch

Changes to ChangeLog.






1
2
3
4
5
6
7





2012-12-22  Alexandre Ferrieux  <[email protected]>

	* generic/tclUtil.c: Stop leaking allocated space when objifying a
	zero-length DString. [Bug 3598150] spotted by afredd.

2012-12-21  Jan Nijtmans  <[email protected]>

>
>
>
>
>







1
2
3
4
5
6
7
8
9
10
11
12
2012-12-27  Jan Nijtmans  <[email protected]>

	* generic/tclListObj.c: [Bug 3598580]: Tcl_ListObjReplace may release
	deleted elements too early

2012-12-22  Alexandre Ferrieux  <[email protected]>

	* generic/tclUtil.c: Stop leaking allocated space when objifying a
	zero-length DString. [Bug 3598150] spotted by afredd.

2012-12-21  Jan Nijtmans  <[email protected]>

Changes to generic/tclListObj.c.

904
905
906
907
908
909
910




911
912
913
914
915
916
917
	 */

	count = numElems - first;
    }

    isShared = (listRepPtr->refCount > 1);
    numRequired = numElems - count + objc;





    if ((numRequired <= listRepPtr->maxElemCount) && !isShared) {
	int shift;

	/*
	 * Can use the current List struct. First "delete" count elements
	 * starting at first.







>
>
>
>







904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
	 */

	count = numElems - first;
    }

    isShared = (listRepPtr->refCount > 1);
    numRequired = numElems - count + objc;

    for (i = 0;  i < objc;  i++) {
	Tcl_IncrRefCount(objv[i]);
    }

    if ((numRequired <= listRepPtr->maxElemCount) && !isShared) {
	int shift;

	/*
	 * Can use the current List struct. First "delete" count elements
	 * starting at first.
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
	    }

	    ckfree(oldListRepPtr);
	}
    }

    /*
     * Insert the new elements into elemPtrs before "first". We don't do a
     * memcpy here because we must increment the reference counts for the
     * added elements, so we must explicitly loop anyway.
     */

    for (i=0,j=first ; i<objc ; i++,j++) {
	elemPtrs[j] = objv[i];
	Tcl_IncrRefCount(objv[i]);
    }

    /*
     * Update the count of elements.
     */

    listRepPtr->elemCount = numRequired;







|
<
<




<







1027
1028
1029
1030
1031
1032
1033
1034


1035
1036
1037
1038

1039
1040
1041
1042
1043
1044
1045
	    }

	    ckfree(oldListRepPtr);
	}
    }

    /*
     * Insert the new elements into elemPtrs before "first".


     */

    for (i=0,j=first ; i<objc ; i++,j++) {
	elemPtrs[j] = objv[i];

    }

    /*
     * Update the count of elements.
     */

    listRepPtr->elemCount = numRequired;